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Abstract 

We consider the problem of testing if a given function / : F2 F2 is close to any degree d 
polynomial in n variables, also known as the Reed-Muller testing problem. The Gowers norm 
is based on a natural 2^+^-query test for this property. Alon et al. [AKK+OS] rediscovered this 
test and showed that it accepts every degree d polynomial with probability 1, while it rejects 
functions that are i7(l)-far with probability n{l/{d2'^)). We give an asymptotically optimal 
analysis of this test, and show that it rejects functions that are (even only) 57(2^'^)-far with 
J7(l)-probability (so the rejection probability is a universal constant independent of d and n). 
This implies a tight relationship between the ((i-t-l)^'-Gowers norm of a function and its maximal 
correlation with degree d polynomials, when the correlation is close to 1. 

Our proof works by induction on n and yields a new analysis of even the classical Blum- 
Luby-Rubinfeld [BLR93 linearity test, for the setting of functions mapping F2 to F2. The 
optimality follows from a tighter analysis of counterexamples to the "inverse conjecture for the 
Gowers norm" constructed by |GT09[ ILMS08] . 

Our result has several implications. First, it shows that the Gowers norm test is tolerant, 
in that it also accepts close codewords. Second, it improves the parameters of an XOR lemma 
for polynomials given by Viola and Wigderson [VW07j . Third, it implies a "query hierarchy" 
result for property testing of affine-invariant properties. That is, for every function q{n), it gives 
an affine-invariant property that is testable with 0(g(n))-queries, but not with o((7(n))-queries, 
complementing an analogous result of (GKNR09] for graph properties. 
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1 Introduction 



Can the proximity of a function to a low-degree polynomial be estimated by sampling the function 
in few places? Variants of this question have been studied in two different communities for different 
purposes. 

1.1 Gowers norm 

In the additive combinatorics community, this issue arose in Gowers' notable improvement of Sze- 
meredi's theorem, that any subset of the integers with positive density has infinitely long arithmetic 
progressions. To make his advance, Gowers introduced his uniformity norms, now usually called 
Gowers norms. The motivation for these norms is that if a function / has degree d, then its deriva- 
tive in direction a, f{x + a) — f{x), has degree at most d — 1. Hence the {d + l)-fold derivative 
is 0. Thus, a natural test to decide if a function / has degree d is to set k = d + 1, evaluate the 
/c-fold derivative of / in A; random directions, and accept only if the derivative evaluates to 0. This 
is what we call the k^^ Gowers norm test, Tgn(/c), for k = d + 1. 

Our paper focuses on the field F2 of two elements, and we now restrict to this case. The k^^ Gowers 
norm of / : F2 — >• F2, denoted ||/||^fc, is given by the expression 

def ^ 

||/||^fc^(Pr[rGN(fc) accepts] - Pr[rGN(fc) rejects])^^. 

Gowers |Gow01| (see also |GT08| ) showed that the correlation of / to the closest degree d polynomial 
is at most H/Hc/d+i. The well-known Inverse Conjecture for the Gowers Norm states that some sort 
of converse holds: if ||/||{/d+i = then the correlation of / to some degree d polynomial 

is Lovett et al. |LMS08j and Green and Tao |GT09j disproved this conjecture as stated, 

but a modification of the conjecture remains open, and was recently proven in high characteristic 
[TZl IGTZ091 IGTZlOj . These conjectures and the Gowers norms have been extremely influential. 
For example. Green and Tao |GT09j used the Gowers norms over the integers to prove that the 
primes contain arbitrarily long arithmetic progressions. 

Study of the Gowers norms over F2 has led to impressive results in theoretical computer science. 
Samorodnitsky and Trevisan |ST06) used Gowers norms to obtain very strong PCPs for Unique- 
Games-hard languages. This implied that Maximum Independent Set in graphs of maximum de- 
gree A could not be approximated within A/polylog(A) under the Unique Games Conjecture. 
Using Gowers norms, Bogdanov and Viola [BV07j gave a pseudorandom generator fooling low- 
degree polynomials over F2. They could only prove their result under the inverse conjecture for the 
Gowers norm, but later Lovett |Lov09| and Viola [Vio09j used related ideas to prove an uncondi- 
tional result. Finally, Viola and Wigderson jVW07| used Gowers norms to prove "XOR" lemmas 
for correlation to low-degree polynomials and to low communication protocols. 

1.2 Local testing of Reed-Muller codes 

Traditionally the Gowers norm is used in what Green and Tao call the 1% setting, where the 
correlation of a function to its closest low-degree polynomial is non-negligible but small. The 99% 
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setting, where the correlation is close to 1, was addressed by Alon, Kaufman, Krivelevich, Litsyn, 
and Ron jAKK"'"05] . and is the focus of our work. More precisely, Alon et al. considered the 
question of testing if a Boolean function / : — ?■ F2, given by an oracle, is close to a degree d 
multivariate polynomial. They rediscovered a variation of the Gowers norm test, where all the 
derivative directions are linearly independent, and showed that this test suffices for that setting. 
Thus, their analysis gave the only known relationship between the Gowers norm and the proximity 
to low-degree polynomials in the 99% setting. 

However, their analysis was not optimal. In this work, we give an improved, asymptotically optimal, 
analysis of the Gowers norm test. This gives a tight connection with the Gowers norm in the 99% 
setting. Before we elaborate, let us introduce our framework. 

Our question is also called testing of Reed-Muller codes, which are codes based on low-degree 
polynomials. The Reed-Muller codes are parameterized by two parameters: n, the number of 
variables, and d, the degree parameter. The Reed-Muller codes consist of all functions from — )• F2 
that are evaluations of polynomials of degree at most d. We use RM((i, n) to denote this class, i.e., 
RM{d,n) = {/ : F^ ^ F2I deg(/) < d}. 

The proximity of functions is measured by the (fractional Hamming) distance. Specifically, for 
functions /, g : Fg — )• F2, we let the distance between them, denoted by S{f,g), be the quantity 
Fr^^^Y^lfix) / g{x)]. For a family of functions J" C {5 : F^ ^ F2} let J") = mm{6{f,g)\g G 
T}. We say / is 5-close to if 5{f,T) < 5 and 5-far otherwise. 

Let 5d{f) = 5{f,RM{d,n)) denote the distance of / to the class of degree d polynomials. The 
goal of Reed-Muller testing is to "test", with "few queries" of /, whether / G RM(d, n) or / is 
far from RM((i, n). Specifically, for a function q : Z+ x Z+ x (0,1] — )• Z^, a q-query tester for 
the class RM{d,n) is a randomized oracle algorithm T that, given oracle access to some function 
/ : F2 — >• F2 and a proximity parameter 5 G (0,1], queries at most q = q{d,n,5) values of / and 
accepts / G RM((i, n) with probability 1, while if (5(/, RM((i, n)) > 5 it rejects with probability at 
least, say, 2/3. The function q is the query complexity of the test and the main goal here is to 
minimize q, as a function possibly of d, n and 6. We denote the test T run using oracle access to 
the function f hy . 

As mentioned earlier, Alon et al. [AKK"'"05] gave a tester with query complexity 0(| • 4^^). Their 
tester consists of repetitions of a basic test, which we denote Tgn- ^gn is a modification of the 
Gowers norm test 70^(^+1) so that the ((i+l)-fold derivatives are evaluated in d+1 random linearly 
independent directions. This modified tester, whose rejection probability differs from that of the 
original Gowers norm tester by only a constant factor, can be described alternatively as follows. 
Given oracle access to /, Tqn selects a random {d + l)-dimensional affine subspace A, and accepts 
if / restricted to A is a degree d polynomial. This requires 

2d+i 

queries of / (since that is the 

number of points contained in ^4). Alon et al. show that if 6{f) > 5 then Tgn rejects / with 
probability Q{6/{d- 2'^)). Their final tester then simply repeated Tqn ■ 2*^) times and accepted 
if all invocations of Tqn accepted. The important feature of this result is that the number of queries 
is independent of n, the dimension of the ambient space. Alon et al. also show that any tester for 
RM(d,n) must make at least Q{2'^ + 1/6) queries. Thus their result was tight to within almost 
quadratic factors, but left a gap open. We close this gap in this work. 
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1.3 Main Result 



Our main result is an optimal analysis of the Gowers norm test, up to constants. We show that 
if Sd{f) > 0.1, in fact even if it's at least 0.1 • 2~'^, then in fact the Gowers norm test rejects with 
probability lower bounded by some absolute constant. We now formally state our main theorem. 

Theorem 1 There exists a constant ei > such that for aUd,n, and for all functions / : F2 — )• F2, 
we hav^ 

Pv[T^^ rejects] > mm{2^ • <5d(/),ei}. 

Therefore, to reject functions 6-lar from RM((i, n) with constant probability, a tester can repeat the 
test Tgn at most 0(1/ min{2'^(5d(/), ei}) = 0(1 + ^) times, making the total query complexity 
0(2*^ + 1/(5). This query complexity is asymptotically tight in view of the earlier mentioned lower 
bound in [AKK+05] . 

Our error- analysis is also asymptotically tight. Note that our theorem effectively states that func- 
tions that are accepted by Tqn with constant probability (close to 1) are (very highly) correlated 
with degree d polynomials. To get a qualitative improvement one could hope that every function 
that is accepted by Tqn with probability strictly greater than half is somewhat correlated with 
a degree d polynomial. Such stronger statements however are effectively ruled out by the coun- 
terexamples to the "inverse conjecture for the Gowers norm" given by |LMS08l IGT09| . Since the 
analysis given in these works does not match our parameters asymptotically, we show (see Theo- 
rem [241 in Appendix |A|) how an early analysis due to the authors of |LMS08] can be used to show 
the asymptotic tightness of the parameters of Theorem [TJ 

Our analysis of the Gowers norm test implies a tight relationship between the Gowers norm and 
distance to degree d in the 99% setting. In particular, we show the following theorem. 

Theorem 2 There exists e > such that if ||/||,7d+i > 1 - e/2"', then 5d{f) = 0(1 - ||/||t/d+i). 

For comparison, the best previous lower bound comes from the Alon et al. work, whose result 
can be interpreted as showing that there exists e > such that if ||/||fyd+i > 1 — e/4'^, then 

W) = 0(4^^(1 -ll/ll^.+O)- 

Before explaining our technique, we describe some applications of our result. 
1.4 Tolerant testing of RM codes 

Parnas, Ron, and Rubinfeld [PRR06j introduced the notion of tolerant testing, and Guruswami 
and Rudra |GR05j studied this in the coding theoretic setting. Standard testers are required to 
reject strings that are far from codewords, but are not required to accept strings that are close 
to codewords. A tolerant tester is required to accept close codewords. In particular, for a code 
with minimum (relative) distance 5mm-, there exists constants ci and C2 such that the test must 
accept strings within distance ci(5min with probability at least 2/3 (called the acceptance condition), 

^For a tester T and a function /, the notation indicates the execution of T with oracle access to /. 



4 



and reject strings that are at least (c2(5min)-far with probabihty at least 2/3 (called the rejection 
condition). 

Any tester which satisfies the rejection condition must make at least Q{l/5rain) queries. We observe 
that a tester that satisfies the rejection condition and makes C/dmin queries for a constant C is also 
tolerant. This follows because a string with distance (5min/(3C) will be rejected with probability at 
most 1/3. It even suffices to have the rejection condition with a constant probability (instead of 
2/3), because the test can be repeated a constant number of times to boost the probability to 2/3. 

In particular, for Reed-Muller codes dynm = 2"^^, so the Gowers norm test is also tolerant. No 
tolerant tester for binary Reed-Muller codes appears to have been known. 

Theorem 3 Tqn is a tolerant tester for IiM{d,n) . 

1.5 XOR lemma for low-degree polynomials 

As mentioned earlier, Viola and Wigderson |VW07j used the Gowers norm and the Alon et al. 
analysis to give an elegant "hardness amplification" result for low-degree polynomials. Let / : 
— )• F2 be such that 5d{f) is noticeably large, say > 0.1. Viola and Wigderson showed how to 
use this / to construct a g : F™ — )• F2 such that 6d{g) is significantly larger, around ^ — 2~^(™). In 
their construction, g = /®*, the t-wise XOR of /, where /®* : (Fg)* — )• F2 is given by: 

t 

/®*(xi,...,Xi)= J]/(x,). 

i=l 

In particular, they showed that if 5d{f) > 0.1, then (5rf(/®*) > 1/2— 2"^^*/^'*). Their proof proceeded 
by studying the rejection probabilities of Tqn on the functions / and /®*. The analysis of the 
rejection probability of Tqn given by lAKK+05] was a central ingredient in their proof. By using 
our improved analysis of the rejection probability of Tgn from Theorem [T] instead, we get the 
following improvement. 

Theorem 4 Let ei be as in Theorem{Il Let / : F2 — >■ F2. Then 

^^(^e*) > l-(l-2min{6i/4,2'^~^-W)})*/^'' _ 

Ln particular, if 5d{f) > 0.1, then 5d{f®^) > 1/2 - 2-^(*/2'). 

1.6 Query hierarchy for afRne-invariant properties 

Our result falls naturally in the general framework of property testing [BL R931 IRS961 IGGR98) . 
Goldreich et al. [GKNR09] asked an interesting question in this broad framework: Given an en- 
semble of properties J- = {J-n}n where J-'n is a property of functions on domains of size A^, which 
functions correspond to the query complexity of some property? That is, for a given complexity 
function q{N), is there a corresponding property J-' such that 0(g(A'^))-queries are necessary and 
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sufficient for testing membership in J-jv? This question is interesting even when we restrict the 
class of properties being considered. 

For completely general properties this question is easy to solve. For graph properties [GKNR09] 
et al. show that for every efficiently computable function q{N) = 0{N) there is a graph property 
for which Q{q{N)) queries are necessary and sufficient (on graphs on Q.{^/N) vertices). Thus this 
gives a "hierarchy theorem" for query complexity. 

Our main theorem settles the analogous question in the setting of "affine-invariant" properties. 
Given a field F, a property C {F" — t- F} is said to be affine-invariant if for every f £ and 
affine map j4 : F" — F", the composition of / with A, i.e, the function / o A{x) = f{A{x)), is also 
in J^. Affine-invariant properties seem to be the algebraic analog of graph-theoretic properties and 
generalize most natural algebraic properties (see Kaufman and Sudan [KS08j ). 

Since the Reed-Muller codes form an affine-invariant family, and since we have a tight analysis 
for their query complexity, we can get the affine-invariant version of the result of |GKNR09] . 
Specifically, given any (reasonable) query complexity function q{N) consider N that is a power of 
two and consider the class of functions on n = log2 N variables of degree at most d = [log2 qi^)] ■ 
We have that membership in this family requires $7(2*^) = i7(g(A^))-queries, and on the other hand 
0{2'^) = 0(g(A'^))-queries also suffice, giving an ensemble of properties Vn (one for every = 2") 
that is testable with 0(g(A^))-queries. 

Theorem 5 For every g : N — )■ N that is at most linear, there is an affine-invariant property that 
is testable with 0{q{n)) queries (with one-sided error) hut is not testable in o{q{n)) queries (even 
with two-sided error). Namely, this property is membership in RM([log2 (?(ra)] , n). 

1.7 Technique 

Our main theorem (Theorem [1]) is obtained by a novel proof that gives a (yet another!) new 
analysis even of the classical linearity test of Blum, Luby, Rubinfeld |BLR93j . The heart of our 
proof is an inductive argument on n, the dimension of the ambient space. While proofs that 
use induction on n have been used before in the literature on low-degree testing (see, for instance, 
|BFL91llBFLS9HlFGL"'"96| ). they tend to have a performance guarantee that degrades significantly 
with n. Indeed no inductive proof was known even for the case of testing linearity of functions 
from F2 —7- F2 that showed that functions at 1^(1) distance from linear functions are rejected with 
0(1) probability. (We note that the original analysis of [B LR93j as well as the later analysis of 
[BCH"'"96] do give such bounds - but they do not use induction on n.) In the process of giving a 
tight analysis of the |AKK+05| test for Reed-Muller codes, we thus end up giving a new (even if 
weaker) analysis of the linearity test over Fj . Below we give the main idea behind our proof. 

Consider a function / that is (5- far from every degree d polynomial. For a "hyperplane" , i.e., an 
(n — l)-dimensional affine subspace A of F2 , let /|^ denote the restriction of / to A. We first note 
that the test can be interpreted as first picking a random hyperplane A in F2 and then picking a 
random ((i+ l)-dimensional affine subspace A' within A and testing if /|^/ is a degree d polynomial. 
Now, if on every hyperplane j4, /|^ is still J-far from degree d polynomials then we would be done 
by the inductive hypothesis. In fact our hypothesis gets weaker as n — )• 00, so that we can even 
afford a few hyperplanes where /|a is not (5-far. The crux of our analysis is when for several (but 
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just 0(2'^)) hyperplanes /U is close to some degree d polynomial Pa- In this case we manage to 
"sew" the different polynomials Pa (each defined on some (n — l)-dimensional subspace within ) 
into a degree d polynomial P that agrees with all the -Pa's. We then show that this polynomial is 
close to /, completing our argument. 



To stress the novelty of our proof, note that this is not a "self-correction" argument as in AKK"'"05 



where one defines a natural function that is close to P, and then works hard to prove it is a 
polynomial of appropriate degree. In contrast, our function is a polynomial by construction and 
the harder part (if any) is to show that the polynomial is close to /. Moreover, unlike other 
inductive proofs, our main gain is in the fact that the new polynomial P has degree no greater than 
that of the polynomials given by the induction. 



Organization of this paper: We prove our main theorem, Theorem [H in Section [2] assuming 
three lemmas, two of which study the rejection probability of the /c-dimensional affine subspace test, 
and another that relates the rejection probability of the basic (d-l-l)-dimensional affine subspace test 
to that of the fc-dimensional affine subspace test. These three lemmas are proved in the following 
section. Section [3l 

We give the relationship to the Gowers norm in Section [H and we prove our improved hardness 
amplification theorem, TheoremHl in Section[5l Finally, we show the tightness of our main theorem 
in the appendix. 



2 Proof of Main Theorem 

In this section we prove Theorem [TJ We start with an overview of our proof. Recall that a fc-flat 
is an affine subspace of dimension k, and a hyperplane is an (n — l)-fiat. 

The proof of the main theorem proceeds as follows. We begin by studying a variant of the basic 
tester Tgn, which we call T^^ ^ or the k-flat test. For an integer k > d + 1, picks a uniformly 
random fe-fiat in ¥2, and accepts if and only if the restriction of / to that fiat has degree at most d. 
In this language, the tester Tqn of interest to us is T^^d+i- To prove Theorem [H we first show that 
for k ^ d + 10, the tester rejects with constant probability if Sd{f) is il(2^'^) (see Lemma[9]). 
We then relate the rejection probabilities of and Tq^ (see Lemma [TO]l . 

The central ingredient in our analysis is thus Lemma [9] which is proved by induction on n, the 
dimension of the ambient space. Recall that we want to show that the two quantities (1) 6d{f) and 
(2) Pr[rJ^ rejects], are closely related. We consider what happens to / when restricted to some 
hyperplane A. Denote such a restriction by /{a- For a hyperplane A we consider the corresponding 

J" I 

two quantities (1) (^^(/Ia) and (2) Pr[Tj^'* rejects]. The inductive hypothesis tells us that these two 
quantities are closely related for each A. Because of the local nature of tester T^^k, it follows easily 
that Pr[Tj^ rejects] is the average of Pr[rf|f rejects] over all hyperplanes A. The main technical 
content of Lemma [9] is that there is a similar tight relationship between 5d{f) and the numbers 
'5(i(/U) as A varies over all hyperplanes A. This relationship suffices to complete the proof. The 
heart of our analysis focuses on the case where for many hyperplanes (about 2'^ of them, independent 
of n), the quantity Sd{f\A) is very small (namely, for many A, there is a polynomial Pa of degree d 
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that is very close to /|^). In this case, we show how to "sew" together the polynomials Pa to get 
a polynomial P on that is also very close to /. In contrast to prior approaches which yield a 
polynomial P with larger degree than that of the Pa's, our analysis crucially preserves this degree, 
leading to the eventual tightness of our analysis. 

We now turn to the formal proof. 

2.1 Preliminaries 

We begin by formally introducing the fc-flat test and some related notation. 

Definition 6 (/c-flat test T^^k) The test picks a random k-flat A Q ¥2 and accepts if and 
only if f\A if restricted to A) is a polynomial of degree at most d. 

The rejection probability ofT^^^ is denoted Rej^^(/). In words, this is the probability that f\A is 
not a degree d polynomial when A is chosen uniformly at random among all k-flats of F2 ■ 

Although we don't need it for our argument, we note that Tqn = ^d.d+i accepts if and only if the 
2d+i evaluations /|a sum to 0. 

The following folklore proposition shows that for k > d + 1, T^^k has perfect completeness. 
Proposition 7 For every k > d + 1, 6d{f) = if and only if Rej^^ ;,(/) = 0. 

2.2 Key Lemmas 

We now state our three key lemmas, and then use them to finish the proof of Theorem [TJ The first 
is a simple lemma that says if the function is sufficiently close to a degree d polynomial, then the 
rejection probability is linear in its distance from degree d polynomials. 

Lemma 8 For every k,£,d such that k >£> d+1, if 5{f) = 5 then Rejrffc(/) > 2^ ■6-{l-{2^ -1)5). 
In particular, if S < 2~('^+^) then Reid,k{f) > min{|,2'^"^ • S}. 

The next lemma is the heart of our analysis and allows us to lower bound the rejection probability 
when the function is bounded away from degree d polynomials. 

Lemma 9 There exist positive constants (3 < 1/4, eo, 7 and c such that the following holds for 
every d,k,n, such that n > k > d + c. Let / : F'2 — )• F2 be such that 6{f) > (3 ■ 2~^. Then 
Rejd,fc(/)>eo + 7-2^/2". 

The final lemma relates the rejection probabilities of different dimensional tests. 
Lemma 10 For every n, d and k > k' > d + 1, and every / : Fg — >■ F2, we have 

Rej,,,,(/)>Rejd,fc(/)-2-('-''^. 
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Given the three lemmas above, Theorem [T] follows easily as shown below. 

Proof of Theorem [H Let eg and c be as in LemmaO We prove the theorem for ei = eo • 2^^^"^^ 
First note that if < 2'^'^+'^^ then we are done by Lemma[8l So assume 6{f) > 2 (^^+2) > (3-2 
where /3 is the constant from Lemma [H By Lemma [H we know that ^s]d d+df) — ^o- Lemma [TOl 
now implies that ^^jd d+iif) ^ ^0 ■ 2~^'^~^\ as desired. ■ 



3 Analysis of the /c-flat test 

Throughout this section we fix d, so we suppress it in the subscripts and simply use 5{f) = 6d{f) 
and Rejfc(/) = Rejrf fc(/). 

3.1 Lemma [8t When / is close to RM{d,n) 
Recall that we wish to prove 

Lemma [8] (recalled): For every k,£,d such that k > i > d + 1, if 6{f) = S then Rej^(/) > 
2^ • 5 • (1 - (2^ - 1)6). In particular, if 6 < 2'^'^+^^ then Rejfc(/) > min{i,2'^-i • 5}. 

Proof of Lemma [§} The main idea is to show that with good probability, the flat will contain 
exactly one point where / and the closest degree d polynomial differ, in which case the test will 
reject. The main claim we prove is that Rej£(/) > 2^ • (5 • (1 — (2^ — 1)6). The first part then follows 
from the monotonicity of the rejection probability, i.e., Rej^(/) > Rej^(/) if k > i. The second part 
follows by setting ^ = A; if 5 < 2-('=+i) and £ such that 2" (^+2) < 6 < 2 ^^^^^ otherwise. In the 
former case, we get Rejfc(/) > 2^*^'^^-'^^ • 6 while in the latter case we get Rej;j(/) > Rej^(/) > |. We 
thus turn to proving Rej^(/) > 2^ • 5 • (1 - (2^ - 1)6). 

Let g G RM((i, n) be a polynomial achieving 6{f) = 6{f,g). Consider a random ^-flat A of 
We think of the points of A as generated by picking a random full-rank matrix M G Fg^^ and a 

random vector b G Fg, and then letting A = {ax'=Mx + 6 | x G Fg}. Thus the points of A are 
indexed by elements of F2 . 

For X G Fg, let Ex be the event that ^^f{ax) 7^ g{axy^ ■ Further let Fx be the event that ^^f{ax) 7^ 
g{ax) and f{ay) = g{ay) for every y / x". We note that if any of the events Fx occurs (for x G Fg), 
then the £-flat test rejects /. This is because distinct degree d polynomials differ in at least 2^'^ 
fraction of points, so they cannot differ in exactly one point if £ > d. 

We now lower bound the probability of ^xFx- Using the fact that is distributed uniformly over 
F2 and ay is distributed uniformly over F2 — {a^}, we note that Pr[i?a;] = 6 and Pr[£^a; and Ey\ < 5^. 
We also have Pr[Fx] > PvlEx] - Ylyjtx ^A^x and Ey] > 6 - (2^ - 1) • 6"^. Finally, noticing that the 
events Fx are mutually exclusive we have that Pr[UjFj] = Y^ - Pr[Fj] > 2^ • 5 • (1 — (2^ — 1) • 5), as 
claimed. ■ 
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3.2 Lemma [9t When / is bounded away from RM{d,n) 

The main idea of the proof of Lemma [9] is to consider the restrictions of / on randomly chosen 
"hyp er planes" , i.e., (n — l)-flats. If on an overwhelmingly large fraction (which will be quantified 
in the proof) of hyperplanes, our function is far from degree d polynomials, then the inductive 
hypothesis suffices to show that / will be rejected with high probability (by the fc-flat test). The 
interesting case is when the restrictions of / to several hyperplanes are close to degree d polynomials. 
In Lemma [T2] we use the close polynomials on such hyperplanes to construct a polynomial that has 
significant agreement with / on the union of the hyperplanes. 

We start by first fixing some terminology. We say A and B are complementary hyperplanes if 
Au B = F2 . Recalling that a hyperplane is the set of points {x G ¥2\L{x) = b} where L : — )• F2 
is a nonzero linear function and 6 G F2, we refer to L as the linear part of the hyperplane. We 
say that hyperplanes Ai,...,Ai are linearly independent if the corresponding linear parts are 
independent. The following proposition lists some basic facts about hyperplanes that we use. The 
proof is omitted. 

Proposition 11 (Properties of hyperplanes) 1. There are exactly 2^'^^ — 2 distinct hyper- 
planes in ¥2- 

2. Among any 2^ — 1 distinct hyperplanes, there are at least £ independent hyperplanes. 

3. There is an affine invertible transform that maps independent hyperplanes Ai, . . . , Ag to the 
hyperplanes xi = 0, X2 = 0, . . . , = 0. 

We are now ready to prove Lemma [9l We first recall the statement. 

Lemma [9] (recalled): There exist positive constants (3 < 1/4, eo, 7 and c such that the following 
holds for every d, k, n, such that n > k > d + c. Let / : Fg — )• F2 be such that 6{f) > (3 ■ 2~'^. Then 
Rej,,fc(/)> 60 + 7-2^2". 

Proof of Lemma [9t We prove the lemma for every /3 < 1/24, eo < 1/8, 7 > 72, and c such that 
2^= > max{47/(l - 8eo),7/(l - eo),2/^}. (In particular, the choices /3 = 1/25, eo = 1/16, 7 = 72 
and c = 10 work.) 

The proof uses induction on n — A;. When n = k we have Rej^(/) = 1 > eo + 7 • 2'^"'^ as required, 
because 2'^ > So we move to the inductive step. 

Let 7i denote the set of hyperplanes in Fg . Let N = 2(2" — 1) be the cardinality of Ti. Let Ti* be 
the set of ah the hyperplanes AgH such that (5(/U, RM(d, n - 1)) < /3 • 2"*^. Let K = |^*|. 

Now because a random fc-flat of a random hyperplane is a random /c-fiat, we have 

Rejfc(/) = E^g^[Rej,(/U)]. 

By the induction hypothesis, for any A £ 'H\ Ti*, we have 

2d 

Rejfc(/U) > eo + 7- 
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Thus, 

Rei,if)>eo + 7-^-K/N. 
We now take cases on whether K is large or small: 

1. Case 1: A' < 7 • 2'^. 

In this case, Rej;,(/) > eo + 7 • 2'^/2"-i - K/N > eo + 7 • 2'^/2'^ as desired. 

2. Case 2: AT > 7 • 2'^. 

Lemma [12] (below) shows that in this case, 5{f) < |/3 • 2-^ + 9/(72'^) =S5o, provided /? • 2"'^ < 
2-{d+2) (^j^ich holds since /?< 1/24 < 1/4). 

Note that since (3 < 1/24 and 9/7 < 1/8, we get 60 < 2"^'^^^) and so Lemma [8] implies that 
R^ikif) ^ min{2'^~^ • S{f), |} > min{2*''~^ • /3 ■ 2"*^, |}. We verify both quantities above are 
at least eq + 7/2('=+i) > eq + -f2'^/2'^. The condition 1/8 > eq + 7/2^+^ follows from the fact 
that 2" > 47/(1 - 8eo). To verify the second condition, note that 2^-^ ■ jS ■ 2''^ > 2''-^(3 > 1 
since 2" > 2//3. 

We thus conclude that the rejection probability of / is at least eo + 7 • 2'^/2" as claimed. ■ 



Lemma 12 For / : F2 — s- F2, let Ai, . . . , Ak be hyperplanes such that f\Ai is a-close to some 
degree d polynomial on Ai. If K > 2^+^ and a < 2~^^~^'^\ then 6{f) < |a + 9/K. 

Proof Let Pi be the degree d polynomial such that is a-close to Pj. 

Claim 13 If4a< 2^'^ then for every pair of hyperplanes Ai and Aj, we have Pi\AinAj = PjlAjiiAi- 

Proof If Ai and Aj are complementary then this is vacuously true. Otherwise, |Aj H = 
\Ai\/2 = \Aj\/2. So 6ifUnA,,Pi\A,nAj) < 2<5(/U,,Pi) < 2a and similarly <5(/U.nA,, ^iU.nA,) < 
2a. So 6{Pi\AinAj , PjlAiCiAj) < 4a < 2"°'. But these are both degree d polynomials and so if their 
proximity is less than 2~^ then they must be identical. ■ 

Let i = [log2(ii' + 1)J. Thus i > d. By Proposition 1111 there are at least i linearly independent 
hyperplanes among Ai, . . . , Ak- Without loss of generality let these be ^1, . . . , A^. Furthermore, 
by an affine transformation of coordinates, for i S [P\ let Ai be the hyperplane {x S | Xj = 0}. 
For i G [P\ extend Pi to a function on all of F2 by making Pi independent of Xi. We will sew 
together Pi, . . . , to get a polynomial close to /. 

Let us write all functions from Fg — )• F2 as polynomials in n variables and y where 

y denotes the last n — i variables. For i £ [i] and S C let Pi,s(y) be the monomials of Pj 
which contain Xi for i € S, and no Xj for j [i]. That is, Pi,s(y) are polynomials such that 
Pi{xi, . . . ,X£,y) = J2sc[e]^i,s(y)Y\j£S^J- Note that the degree of Pi^s is at most d— \S\. (In 
particular, if \S\ > d, then Pj^g = 0.) Note further that since Pi is independent of Xi, we have that 
Pi,5 = if i G 5. 
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Claim 14 For every S C [i] and every i,j £ [i] — S, i-*j,s(y) = Pj,s{y)- 

Proof Note that PiU^nA, (x, y) = 'Esc[e]~{i,j} Pi,s{y)Ilm(^s ^rn- Similarly PjU,nA,(x,y) = 
Ylsc[e]-{i j} ^j,s{y) Times Since the two functions are equal (by Claim [T3|) . we have that every 
pair of coefficients of IlmeS^™ must be the same. We conclude that Pi^s = Pj,s- • 

Claim [U] above now allows us to define, for every S C the polynomial Psiy) as the unique 
polynomial Pi^s where i ^ S. We define 

P{xi,...,Xi,y) = ^ Ps(y)n^i- 

By construction, the degree of P is at most d. This is the polynomial that we will eventually show 
is close to /. 

Claim 15 For every i £ [K], P\Ai = PiU^- 

Proof First note that for each i G [£], P\Ai = PiUi- This is because the coefficients of the two 
polynomials become identical after substituting Xi = (recall that Ai is the hyperplane {x G | 

X^ = 0}). 

Now consider general i G [K]. For any point x £ Ai n (Uj=i^j)) letting j* G [£] be such that 
X G Aj*, we have Pi{x) = Pj^{x) (by Claim [T3|) and Pj*{x) = P{x) (by what we just showed, since 
j* G [£]). Thus P and Pj agree on all points in Ai n (jJj^^Aj). Now since £ > d, we have that 

\Ai n (Uj=i ^ 1 ~ > 1 — 2~'^, and since P\Ai and PiU, are both degree d polynomials, 

we conclude that P|^. and Pi\Ai are identical. Thus for all i G [K], P\a^ = PjU,- ■ 

We will show below that P is close to /, by considering all the hyperplanes Ai, . . . , Ak- If these 
hyperplanes uniformly covered P^, then we could conclude 5{f, P) < q, as / is a-close to P on each 
hyperplane. Since the Ai don't uniformly cover Fg, we'll argue that almost all points are covered 
approximately the right number of times, which will be good enough. To this end, let 

Bad = {z G F2 I-z is contained in less than of the hyperplanes Ai, . . . , A^}- 

Let r = |Bad|/2'^. 

Claim 16 5(/, P) < 3/2 • a + r. 

Proof Consider the following experiment: Pick 2; G Fg and i G [K] uniformly and independently 
at random and consider the probability that "2: G Ai and f{z) 7^ Pi(z)". On the one hand, we have 

Vi[z&A,kf{z)^Pi{z)] 

< maxPr[z G Ai] ■ Pr[/(z) / P,{z)\z G A,] 

i z z 

1 

< -^a 
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On the other hand, using the fact that P\Ai = Pi, we have that 



Pr[z eAik f{z) / P{z)] 

z,i 

= Fr[zeAkf{z)^P{z)] 

z,i 

> Pv[z eAik f{z) / P{z) hzi Bad] 

= Pr[/(2) / P(z) & z Bad] • Pr[z G Ai\f{z) / P(z) & z Bad] 

z z,i 

> Pr[/(z) / P{z) k z^ Bad] • min Pr[z G A^] 

^ ziz^BAD & f{z)^P(z) i 

> {d{f, P)-t)- min Pr[z G A^] 

2:20BAD « 

> (5(/,P)-r).i 

We thus conclude that ((5(/, P) — t)/3 < a/2 yielding the claim. ■ 



Claim 17 r < 9/A". 

Proof The proof is a straightforward "pairwise independence" argument, with a slight techni- 
cality to handle complementary hyperplanes. 

Consider a random variable z distributed uniformly over Fg. For i G [K], let Yi denote the random 
variable that is +1 \i z ^ Ai and —1 otherwise. Note that z G Bad if and only if ^ — ~K/2> 
and so r = Pr[^^ Yi < —K/3]. We now bound this probability. 

For every i, note that E\Yi] = and Var[li] = 1. Notice further that if Ai and Aj are not 
complementary hyperplanes, then Yi and Yj are independent and so ii^[yil^] = 0, while if they are 
complementary, then E[YiYj] = — 1 < 0. We conclude that E['^-Yi\ = and Var[^jyj] < K. 
Using Chebychev's bound, we conclude that r = PrfXli^^i < -K/3] < Y&T{Y,iZi)/{K'^ /9) < 9/K. 



The lemma follows from the last two claims above. ■ 



3.3 Lemma llOt Relating different dimensional tests 

Lemma 18 Let k > d+1 and let f : ¥2'^^ — )■ F2 have degree greater than d. Then Rej^ ^(/) > 1/2. 

Proof Assume for contradiction that there is a strict majority of hyperplanes A on which /|a 
has degree d. Then there exists two complementary hyperplanes A and A such that f\A_ and /|^ 
both have degree d. We can interpolate a polynomial P of degree at most d+1 that now equals / 
everywhere. If P is of degree d, we are done, so assume P has degree exactly d+1 and let Ph be 
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the homogenous degree d + 1 part of P (i.e„ P = Ph + Q where deg(Q) < d and Ph is homogenous). 
Now consider all hyperplanes A such that /|^ = P\a has degree at most d. Since these form a 
strict majority, there are at least ^(2'^"'"^ — 2) + 1 > 2^~^^ — 1 such hyperplanes. It follows that there 
are at least A; + 1 > d + 2 linearly independent hyperplanes such that this condition holds. By an 
affine transformation we can assume these hyperplanes are of the form xi = 0, . . . , X(iJr2 = 0. But 
then nf=i -^i divides P^ which contradicts the fact that the degree of Ph is at most d+1. M 



Lemma 19 Let n > k > d + 1 and let / : F2 — )• F2 have degree greater than d. Then Rej^ ^(/) > 

Proof The proof is a simple induction on n. The base case of n = is trivial. Now assume for 
n — 1. Pick a random hyperplane A. With probability at least 1/2 (by the previous lemma), is 
not a degree d polynomial. By the inductive hypothesis, a random fc-flat of A will now detect that 
is not of degree d with probability 2'^"""'"^. We conclude that a random fc-flat of yields a 
function of degree greater than d with probability at least 2^^"". ■ 

We now have all the pieces needed to prove Lemma [TUl 

Lemma 1101 (recalled): For every n,d and k>k'>d+l, and every / : Fg — )• F2, we have 

Rej,,fc,(/)>ReMfc(/)-2-('-''^. 



Proof of Lemma llOt We view the A;'-flat test as the following process: first pick a random /c-flat 
Ai of F2, then pick a random fc'-flat A of ^1, and accept iff f\A is a degree d polynomial. Note 
that this is completely equivalent to the /c'-flat test. 

To analyze our test, we first consider the event that is not a degree d polynomial. The 

probability that this happens is Rej^^,(/). Now conditioned on the event that is not a degree 
d polynomial, we can now use Lemma [19] to conclude that the probability that (/|ai)|a is not a 
degree d polynomial is at least 2~'^^~^\ We conclude that Rej^;j/(/) > Rej^;j(/) • 2~^^~'^\ The 
lemma follows. ■ 



4 Gowers norms 



Our main theorem can be interpreted as giving a tight relationship between the Gowers norm of 
a function / and its proximity to some low degree polynomial. In this section we describe this 
relationship. 

We start by recalling the definition of the test T^^f^j^-^ and the Gowers norm ||/||[/fc. On oracle access 
to function /, the test Tgi^(^) picks xq and directions ai, . . . , uniformly and independently in F2 
and accepts if and only if /|^ is a degree k — 1 polynomial, where A = {xq + span(ai, . . . ,ajt)}. 
The Gowers norm is given by the expression 

=^(Pr[T^N(fc) accepts] - Pr[r^j^(^) rejects])^. 
14 



Our main quantity of interest is the correlation of / with degree d polynomials, i.e., the quantity 
l-2<5rf(/). 

Our theorem relating the Gowers norm to the correlation is given below. 

Theorem 20 There exists e > such that if > 1 - then 5d{f) = 0(1 - 

To prove the theorem we first relate the rejection probability of the test Tqn(^_,_]^') with that of the 
test Tgn- 

Proposition 21 For every n>d+l and for every f, Pr[T^j^j.^_^-^^rejects] > ^ ■ Pr[TQj>^rejects]. 

Proof We show that with probability at least 1/4, the Oj are linearly independent. Consider 
picking d independent vectors ai, . . . , in . For fixed /3i, . . . , /3rf S F2 (not all zero), the proba- 
bility that PiOi = is at most 2~". Taking the union bound over all sequences /3i, . . . , /3rf we find 
that the probability that ai, . . . , have a linear dependency is at most 2°'""' > ^ if n > d + 1. For 
any fixed oi, . . . , a^, the probability that aa+i G span(ai, . . . , ad) is also at most ^. Thus we find 
with probability at least 1/4, the vectors ai, . . . , a^+i are linearly independent provided n > d+1. 
The proposition follows since the rejection probability of ^(^^(d+i) equals the rejection probability 
of Tqj^ times the probability that ai, . . . , a^+i are linearly independent. ■ 



We are now ready to prove Theorem 1201 

Proof of Theorem I20t The proof is straightforward given our main theorem and the work of 
Gowers et al. |GowOH IGT08] . As mentioned earlier, Gowers already showed that 1 — 25d{f ) < 
ll/llc/.+i [G5^ [nT08], i.e., 5d{f) > (1 - ||/||f/.+i)/2. 

For the other direction, suppose ||/||^d+i = 1 — 7, where 7 < for small enough e. Let p denote 
the rejection probability of T^^f^^^-^y By Proposition [21] we have p>\ - ^^\d,d+i{f)- By choosing e 

small enough, we also have 1 — 2p = WfW^^l^ > 1 — ei/2, i.e., p < ei/4, so ^Qid,d+i{f) < ^i- Thus, 
by Theorem [H 

Sdif) < ^Rej,,,+i(/)(/) 



1 



:i-(i-7) 



2°- 



2d-i 

< ^(l-(l-0(2'+S))) 
= 0(7), 



as required. 
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5 XOR lemma for low-degree polynomials 



A crucial feature of the test Tgn^^) (that is not a feature of the A;-flat test for k > d + 1) is that 
the rejection probability of /®* can be exactly expressed as a rapidly growing (in t) function of the 
rejection probability of /. Let Rej2(/) denote the rejection probability of rGN(d+i)' Then we have: 

Proposition 22 

(1 - 2Rej°(/®*)) = (1 - 2RejO(/))*. 

Proof We first note that the proposition is equivalent to showing that = (ll/llc/rf+i)*- 

It is a standard fact (e.g., Fact 2.6 in |VW07j ) that for functions f,g on disjoint sets of inputs, 
||/(x) + g{y)\\ud+i = ||/(x)||^d+i • ||g(y)||(7d+i. This immediately yields the proposition. ■ 

We also use the following well-known relationship between the Gowers norm and the correlation of 
a function to the class of degree d polynomials. (We state it in terms of the rejection probability 
of the test TGN(d+i)-) 

Lemma 23 ( jGowOlL lUTOS] ) 

l-26d{g) < (l-2RejO(5))^. 

We are now ready to prove Theorem U] which we recall below. 
Theorem ll(recalled): Let / : ^ Fa- Then 

> l-(l-2min{6i/4,2'^-^-W)})*/^' ^ 

In particular, if 6d{f) > 0.1, then 6d{f®^) > l^^l!^^. 
Proof of Theorem |4l By Theorem [1] and Proposition [211 

Rej0(/)>min{6i/4,2^-2.^^(_^)|_ 

Thus by Proposition 1221 

(1 - 2Rej|J(/®*))^ = (1 - 2RejO(/))^ < (1 - 2min{ei/4, 2^^-^ • 5d{f)})^. 
Finally, Lemma [23] shows that 

. ,,etN ^ l-(l-2min{6i/4,2'^-2-^,(/)})^ 
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A Tightness of main theorem 

In this section we show that our main theorem cannot be improved asymptotically. Specifically, we 
show that there is a constant a > 1/2 such that for infinitely many d, for sufficiently large n, there 
exists a function / = fd^n : F2 — >• F2 that passes the degree d AKKLR test (i.e., the l)-flat test) 
with probability a (i.e., strictly greater than half) while being almost uncorrelated with degree d 
polynomials. 

Our example comes directly from the works of |LMS081 IGT09] . In particular, the function /^^^ is 
simply the degree d + 1 symmetric polynomial over n variables (defined formally below). When 
d -\- \ is a power of two, then [LMSOSl [GT09] (who in turn attribute the ideas to [ABOl] ^ already 
show that this function is far from every degree d polynomial. To complete our theorem we only 
need to show that this function passes the {d+ l)-flat test with probability noticeably greater than 
1/2. |LMS08[ [GT09] also analyzed this quantity, but the pubhshed versions only show that this 
function passes the ((i+ l)-flat test with probability l/2 + e{d) where e{d) — )• as d — )• 00. However, 
it turns out that an early (unpublished) proof by the authors of [LMS0 8] can be used to show that 
the acceptance probability is 1/2 + e where e is an absolute constant. For completeness we include 
a complete proof here. 

We start with the definition of the counterexample functions. For positive integers d, n with d < n, 
let Sd,n : ^ F2 be given by 

Sd,n{xi, . . . , Xn) = ^ ^ |^ X^. 

IC[n],\I\=dieI 

Theorem 24 Let d + 1 = 2* for some integer t > 2. Then, for every e > 0, there exists hq such 
that for every n > uq, the following hold: 

1- Sd{Sd+i,n) > 1/2 - e. 

2. Reid,d+iiSd+i,n) < 1/2- 2-7 + e. 

Theorem 1241 follows immediately from the following two lemmas. 

Lemma 25 ((GTOH Theorem 11.3]) Let d + 1 = 2^ for some integer t > 0. Then, for every 
e > 0, for sufficiently large n, we have 6diSd+i,n) ^ 1/2 — e. 

Lemma 26 For every d > 3 and e > 0, for sufficiently large n, we have Rej^ (i+iiSd+i,n) < 
l/2-2-'^ + e. 
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We prove Lemma [26] in the rest of this section. We stress again that this approach is from an 
unpubhshed version of |LMS08| . and we include it for completeness. 

We start with some notation. For oi, . . . , a^+i G F2, let I{x, ai, . . . , ad+i) = 1 if the (d + 
l)-flat test rejects Sd+i,n when picking the affine subspace x + span(ai, . . . , Orf+i). Note that 
Rejd,d+i('S'd+i,n) = ^x,ai,...,ad+i [I{x, tti, . . . , a^+i)], where the expectation is taken over x, oi, . . . , aa+i 
picked uniformly and independently from Fj, conditioned on oi, . . . ,0^+1 being linearly indepen- 
dent. 

Lemma 27 For x, oi, . . . , a^+i G F'2, let M G ]p('^+i)><" ^/^g ^^Hj^ix whose i^^ row is ai. Then 
I{x, ai, . . . , fld+i) = 1 if and only if M ■ M'^ is of full rank. 

Note that the acceptance of the {d + l)-flat is independent of x; this is explained in the proof. 
Proof For each / C [n], |I| = d + 1, we define the polynomial fi{x) = Hie/ ^i- Note that 

Sd+l,n = ^ //• 
IQ[n],\I\=d+l 

Now, the {d + l)-flat test accepts Sd+i,n when picking the affine subspace x + span(ai, . . . , ad+i) if 
and only if 

Sd+i,n{x + ^ aj) = 0. (1) 

JQ[d+i\ jeJ 

Note that the acceptance of the {d + l)-flat test is independent of x. This is because Sd+i,n is a 
degree d+1 polynomial, so it's (d+ l)st derivative (the output of the (d+ l)-flat test) is constant. 
Hence, the test accepts if and only if 

J2 •5d+i,„Ea,) = 0, (2) 
jc[d+i] jeJ 

which can be rewritten as 

IQn],\I\=d+lJC[d+l] jeJ 

For a fixed /, we focus our attention on the expression Yljc[d+i] fii'l^jej'^j)- definition, this 

equals Ejc[<i+i] Die/d^ieJ "i.^) ^^ich in turn equals Ejc[d+i](-l)'^^^"'^' Dig/CEjeJ (^mce 
1 = —1 in F2). By Ryser's formula, this equals perm(M7), where perm is the permanent function, 
and Mj is the {d + 1) x (d + 1) submatrix of M formed by the columns of I. 

Thus, the left hand side of Equation ([1]) equals 

perm(M/). 

ICln],\I\=d+l 

Since we are working over Fo, we have that perm(M7) = det(M/) = det(M/)2. Thus, 
^ perm(M7) = ^ det{Mif 

/C[ri],|/|=d+l /C[n],|/|=d+l 

= det(MM"^). by the Cauchy-Binet formula 
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We thus conclude that I{x, oi, . . . , ad+i) = 1 if and only if MM'^ is nonsingular. 



We thus turn our attention to the probability that for a randomly chosen matrix M, the matrix 
M ■ is of full rank. We first note the following fact on the distribution of M ■ when M is 
chosen uniformly from the space of full rank matrices. 

Lemma 28 Let A,Bg random variables generated as follows: A is a symmetric 

matrix chosen uniformly at random, and B = M ■ M'^ where M is a random {d + 1) x n matrix 
chosen uniformly from matrices of rank d+ 1. Then the total variation distance between A and B 
is 0(2'^-"). 

Proof Let E be the event that the rows of M, along with the vector 1 (the vector which is 1 in 
each coordinate) are all linearly independent. Note that the probability of E is at least 1 — 2^^+^"". 
We will now show that the distribution of B\E is exp(— n)-close to the distribution of A. This will 
complete the proof. 

Let the rows of M be oi, . . . , ad+i- We pick them one at at time. Having picked ai, . . . , Oj, the new 
entries of B that get determined by Oj+i are the entries -Bj+i ,j for all j < i + 1 (these determine the 
entries Bj^i^i). If Oj+i is picked uniformly from , then by the linear independence of ai, . . . , Oj, 1, 
we see that the bits 

• Bi^i^i = (cj+i, ai), 



are all uniformly random and independent, as required. However, since we have conditioned on 
E, aj+i is not picked uniformly from F2, but picked uniformly from F2 \ spanjai, . . . ,ai, 1}. Still, 
this distribution of aj+i is 2*+^~"-close to the uniform distribution over Fg, and as a consequence, 
the distribution of the bits Sj+i^i, . . . is 0(2'^~")-close to the distribution of uniform and 

independent random bits. 

To summarize, the entries of the matrix B are exposed in d + 1 rounds. The bits Bij for j < i 
are exposed in round i, and their distribution, conditioned on the bits exposed in all the previous 
rounds, is 0(2'^~"')-close to that of uniform and independent random bits. This implies the desired 
claim on the distribution of -B. ■ 

The final lemma shows that the random symmetric matrix A G jg f^j^ rank with 

probability bounded away from 1/2 by some constant independent of d. This seems to be a well- 



analyzed problem and tBCJ"'"06[ Theorem 4.14] (see also [BM88j for related work) already proves 
this fact; in particular, they show that if A; > 3, a random symmetric k-hy-k matrix over F2 is full 
rank with probability at most 7/16. For completeness, we include a simple proof that establishes 
a weaker bound on the probability of non-singularity. 
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Lemma 29 For k > 4, the probability that a random symmetric matrix A ^¥2^ has full rank is 
at most 1/2-2-'^. 

Proof Let Ai denote the i x i submatrix containing the first i rows and columns of A. We 
consider the probabihty that A has full rank, conditioned upon various choices of The first 

claim below shows that the probability of this event is at most half if the rank of is either 

k — 1 or k — 2; and zero if the rank of is at most k — 3. We then argue in the next claim 

that the probability that Afc-i has rank at most — 3 is bounded below by a positive constant 
independent of k. The lemma follows immediately. 

Claim 30 Fix B G "^^''^''"^^ The following hold: 

1. If Ak-i = B and rank(5) < — 3, then rank(A) < k. 

2. //rank(S) = k-l then PrA[rank(^) = = B]< 1/2. 

3. //rank(S) = k-2 then PrA[rank(^) = k\A^^2 = B]< 1/2. 

Proof Note that for every i, we have rank(ylj) < rank(^j_i) + 2 since Ai may be obtained from 
Ai-i by first adding a column and then a row, and each step may increase the rank by at most 1. 
Part (1) follows immediately. 

For part (2), fix a^^i, . . . , ak,k-i and consider a random choice of ak,k- Since A^^i has full rank, there 
is a unique linear combination of the k — 1 rows of A^^i that generates the row {a^^i, ■ ■ ■ , ak^k-i)- 
A has full rank only if au^k does not equal the same linear combination of ai^^, . . . , ak-\,k-i and the 
probability of this event is at most 1/2. 

Finally for part (3), assume for notational simplicity that Ak-2 has full rank and the (A; — l)th 
row of A is linearly dependent on the first k — 2 rows. Now consider the addition of a fcth row to 
Ak_i consisting of a^^i, . . . , ak^k-i- Note that a necessary condition for A to have full rank is that 
the newly added row is linearly independent of the first k — 2 rows of A^-i (otherwise, the rank 
of the first k — 1 columns of A is only k — 2). But again (as in Part (2)), there is a unique linear 
combination of the rows of Ak-2 that generates the row {ak,i, ■ ■ ■ ,ak,k-2)- The probability that 
a^^k-i equals this linear combination applied to the {k — l)-th column of Ak-i is at least 1/2. ■ 

Claim 31 PrA[rank(^fe_i) < k - 3] > 2'^ . 

Proof We start with the subclaim that for every i, we have Pr[rank(^£_|_i) = rank(A£)|A£] = 
2(rank(A^)-^-i) rp^ ^-^is, let / C [i] be such that A^ restricted to rows in I has full rank (and so 
|/| = rank(yl^)). Then Ai restricted to rows and columns of / also has full rank. (All the rows not 
in / are in the span of the rows that are in I, and thus, by symmetry, all columns not in / are in 
the span of the columns in I.) Fix a^+i j- for j & I and note that there is unique linear combination 
of the rows of I in A^ such that they yield a^+ij for j G I. This linear combination determines a 
unique setting for the remaining £ + 1 — |/| entries of the {I + 1)*^ row of A^+i, if the the rank of 
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A^+i is to equal the rank of A£. The probabiUty of this unique setting occurring equals 2\^\ ^ ^. 
The subclaim follows. 

Now the claim follows easily. Let m be the smallest integer < k — 2 such that rank(^„() > k — 4. 
If such an m does not exist, then rank(^fc_i) < k — 3. Otherwise, m exists, m > k — A and 
Tank{Ajn) < k — 3. Using the subclaim above, we have for every £ G {m, . . . , A; — 2}, it is the case 
that Pr[rank(^^+i) = rank(A^)|A^] > 2('=~^)~^~^. Combining the claims for £ e [m,k - 2] (and 
recalling that m > /c — 4), we get Pr[rank(Ajt_i) < A; — 3] > 2~^. ■ 

Given the claims above, the lemma follows immediately. ■ 
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